Security and execution in 0.70.0

Grid's planned 0.70.0 feature set combines organizational security, governed records and workflows, commercial execution rights, industrial connections, and resilient connected and disconnected operation. Security workstreams formerly labeled 0.67 and 0.68 now belong to this one program on main, retaining the newer 0.69.0 work. Main has advanced to the unreleased 0.71.0 line; the 0.70.0 specification work continues there. Those historical branch labels are separate from the main-line release history. Consolidating source and plans does not mean the complete product is available.

Permissions work together

A purchased capability does not grant access to protected organizational data. An authorized user cannot spend an exhausted commercial allowance or approve their own work when independent review is required. An approved action still needs the current execution owner before it can change authoritative state.

For example, a paid planning Solution can produce a proposed plan only within its admitted permissions. Dispatching that plan additionally requires the appropriate review, current resource ownership and destination authorization. Retrying a committed result must not charge again or repeat a physical action.

Commercial V1 rights do not expire merely because time passes. They remain separate from connected security freshness and audit requirements, and from a bounded offline mission delegation. Refilling an allowance does not extend a mission's authority. Reading a retained paid result still requires current permission to see its contents.

Shared platform, selected Solutions

Grid retains one native formula calculation engine and uses its existing P2P coordination layer for ordinary data sharing, placement and recovery. Consensus is outside the 0.70.0 scope. A future concrete group decision or durability contract may select stronger authority above that ordinary path. Exclusive disconnected mission delegation remains unsupported; no mandatory external mission coordinator or cloud database is introduced.

Manufacturing, Sensitive Research, Care and Defense Logistics Solutions provide domain contracts, workflows, mappings and Views. They reuse platform identity, records, review, execution and recovery. A View or installed Solution cannot grant permission. The Care scope is operational scheduling with read-only source integration, not treatment recommendations or EHR changes.

The proposed Manufacturing Operations Solution starts with imported product definitions, advisory planning, engineering-change review and quality or maintenance analysis. Production transactions, inventory and genealogy require additional shared guarantees before they can become authoritative records. The proposed Sensitive Research Operations Solution builds on existing research evidence and publication tools, adding study, protocol, sample and review workflows. External jobs and automated repository deposition are separately admitted operations, not implied by preparing an evidence package.

Both proposals keep domain vocabulary and workflows in installable Solutions. Shared platform work covers atomic related-record changes, scoped disclosure, protected storage/key recovery, retention and holds, and reliable external operation receipts. A retained record does not automatically remain readable after permission is revoked, and an expired use policy does not automatically authorize deletion. These are development plans, not complete manufacturing, laboratory, regulated-research or general remote-computing products.

Current limitations

Selected enterprise, commercial, industrial and planning components have development implementations. Their integrated production behavior, recovery, provider coverage and performance still need the declared verification work. Enterprise-plus-commercial, native clustered protected execution and the full 72-hour offline mission profile remain unsupported until their required bridges are complete. Unsupported combinations must refuse rather than silently use weaker execution. There is no marketplace availability, accreditation or validated cryptographic-module claim from this consolidation.

Ordinary unselected workloads must remain unchanged. Development verification covers both that ordinary-path cost and the complete cost of selected secure, durable or metered operations; component tests alone cannot establish either.

Distributed model coordination also remains in development. Native mutation observation carries process-local timing through existing publication work; those clocks are omitted from wire data and recovered records. Six genuine native Host and compiled-model tests and full Host checks with observation enabled and disabled pass in development. Shared native and Node conformance and optimized paired latency/resource measurements remain pending. The 1 ms objective is unverified. The small native observation model is a Testing fixture, not proof of a completed connected or offline product.

The opt-in native model bridge binds one certified sticky input and one calculated numeric export to an actual native model, continuing instance, revision, membership and owner fence. Its small model fixture uses the same resident native compiled-model path and durable document/producer owners. Encrypted input can be retained while the model is closed; explicit current admission applies it in order. Receiver persistence and model application remain separate outcomes. The current development slice covers native direct mTLS delivery and original receipt recovery, including an actual Node SDK publisher and restarted subscriber around an intermittently loaded Grid model. An explicit retirement continuation uses the original signed V3 receipt and existing native lifecycle-v3 PROJECTED/SOURCE-READY/confirmed owners. Nonempty native outgoing work uses the actual recovered HTTP outbound runtime and semantic mutex; an offline or unknown child preserves the original producer event. Core's private-mailbox client now composes signed HTTPS requests with the same participant journal. Certificate renewal preserves the original audience, stream, producer and receipt identities; new captures use the enrolled keys. Signed custody retirement retains the original packet and Persisted ACK, and native retirement waits for every native child. See the Core lifecycle example. Installed key custody, provider acceptance, external SDK integration and paired performance evidence remain unfinished; this is a selected development profile.

The selected external native and Node symbol SDK now uses that same native custody owner for finite Number Ordered streams. It supports original capture/receipt replay, bounded reconnect pages and explicit bounded gap recovery. Local route withdrawal survives restart and stops new capture/intake while retaining original deliveries, receipts and uncertain application state. Closing a participant does not claim remote application completion. See the external publisher example. Actual native direct sockets use mTLS and MAC; arbitrary packet DATA never substitutes for that transport admission. Latest symbol baselines, private external SDK mailbox routing, renewal/rotation, signed closure and full SDK coverage remain in development. A replacement certificate/audience cannot silently restart an existing source stream or reopen its withdrawn subscription generation.

An opt-in indexed coordination authority now supports a bounded registered-record CAS and separate authoritative/observed reads. It reuses the existing fixed-voter Raft transaction and retained-handle native storage; Ledger balances, grants, workflow decisions and model inputs retain their own application owners. Original operation receipts survive lost replies and native voter restart. Authoritative reads require a quorum barrier and applied-position wait; quorum loss never silently returns a cached observation. Selected signed snapshot DATA now binds that actual read to its original record position, revision, owner epoch and receipt digest. Native custody output is checked against the admitted key; a local observation keeps its explicit Observed label. This remains internal development: native request/current-rights admission, public Process/SDK/CLI installation, challenge-bound reference captures, the other six authority operations and full platform/Performance coverage are unfinished. It adds no source function or active product view.

Selected coordination control reconciliation development now bounds peer rotation, per-peer HTTP requests and body sizes, and preserves signed-page continuations through failures and restart. It reuses the native control owner and worker; network waits no longer hold that owner's shared lock on the selected path. See the configuration example. This does not install authenticated SWIM/Lifeguard failure detection, confer membership/takeover authority, or establish numerical isolation/performance.

The independent grid-cli main checkout now has native Process operator commands for installed plan/component inspection, original root/operation lookup, explicit revision-bound settlement and cancellation. For example:

gridctl --json --model original-model process operation original-root \
  --principal operator --key-env GRID_OPERATOR_KEY

gridctl --json --model original-model process settle original-root observation.json \
  --principal operator --key-env GRID_OPERATOR_KEY

The read-only operator example requires the original model/root and enrolled credentials before invoking the CLI. The selected host requires its access token and separately enrolled signed operator attribution. Preserve the original inspection; observation.json contains only its Core byte-array operation digest and exact unsigned 64-bit sequence. The native owner checks the original model, principal, frozen operation and revision. A queued settlement is an original-operation lookup, not a terminal result or permission to resume source. Missing/uncertain replies require another inspection of the same root; the CLI creates no operation identity or retry owner. Inputs are regular files bounded to 4096 bytes, responses to 4 MiB and timeouts to 120 seconds. Redirects and insecure remote origins refuse. This command slice uses canonical sibling Core main contracts and does not install the V3 authority, reference, membership, gateway or participant services or complete their CLI set.

Native participant CLI development

The independent CLI now carries device, private-mailbox, selected signal and Ordered-symbol actions to an explicitly pinned native participant executable. The native owner retains permission admission, keys, encrypted journals, publication positions, receipts, pending obligations and recovery. This adapter currently selects Unix development-file custody; it does not establish production key custody or install public authority/reference/membership/gateway endpoints.

gridctl --json --timeout-ms 10000 participant device inspect-lifecycle \
  --owner "$GRID_NODE_OWNER" --owner-sha256 "$GRID_NODE_OWNER_SHA256" \
  --configuration "$GRID_NODE_CONFIGURATION" --key-profile development-file

Use an absolute immutable owner executable/configuration path and the selected owner's actual SHA-256. The read-only example requires those inputs before invoking the native inspector. The CLI never reads the private configuration. Native lifecycle inspection is observational; it does not select a catalog migration decision.

Commands accept exact native action JSON in a bounded regular file. For example, participant device publish-value publish.json carries a PublishValue action with the caller's original capture_id, channel and scalar value. Integer/Number inputs and native counters remain strings; Number observations retain IEEE bits, including signed zero. Keep original packet/receipt DATA and page continuations. Every action recovers existing state; creation and withdrawal are explicit. An actual legacy ambiguity requires a separately supplied original --catalog-recovery decision/digest file verified by the native owner.

A successful operation observation remains known if final Close fails. Native close reports retain unresolved debt and never claim remote completion. Lost replies preserve outcome_unknown and original scope; no action, identity or generation is automatically retried or replaced. The adapter rejects wrong profiles, mismatched correlation, oversized framing and expired IPC deadlines, then reaps its own child process. Host/operator credentials are not forwarded to that separate participant authority.

The Process adapter also exposes explicit process resume original-root original-bindings.json with the selected original model and signed operator attribution. The file must match the original rootId/modelId and carries only native recovery bindings. Resume restores the same frozen wait under native admission; settlement remains an original-operation lookup. An uncertain reply never automatically resumes source or creates another attempt.

The participant CLI's complete command matrix, bounds and source-bound local evidence are in the grid-cli repository. Thirteen participant checks, thirteen Process checks and one explicitly dispatched genuine native recovery journey pass; complete CLI default/reduced-feature type-checks pass. Native network/provider/signal/catalog-migration CLI journeys, installed Host Resume, Windows/Linux, production custody and paired Performance remain unrun. Local packet DATA transfer is not network/provider delivery proof.

Explicit null recovery bindings are preserved for native refusal, rather than becoming omitted defaults; see the verified presence correction.

Core private-mailbox model lifecycle

Select backbone-v3-disconnected-exchange explicitly. SymbolMailboxClient performs one bounded HTTPS attempt for original publication, delivery persistence, ACK upload, receipt inspection or source-signed retirement upload. Requests use current certified Control keys and fresh nonces. TLS, request correlation and signed broker evidence are checked before participant mutation. Broker retention does not settle recipient debt; only the exact signed Persisted ACK does. This client starts no polling worker.

renew_symbol_route enrolls a trusted successor in the existing progress transaction. It cannot change model/revision/instance/owner, rights, schema, membership, delivery mode, audience, subscription generation or producer epoch. It refuses key rollback, stale handles, revocation, backwards clocks and scope expansion. An expired certificate can resume only through current trusted renewal. The selected private-file profile retains at most 16 successor certificates and fails closed at that bound. restore_symbol_route audits the historical issuers and admits the current endpoint after reopen. Old recipient keys must remain in the native keystore until their original encrypted obligations are reconciled.

Direct and mailbox routes share the original captures and receive ACKs. Switching transport never recaptures a value or resets its sequence. The mailbox client uses cursor-free bounded replay: custody is committed before returning an ACK, and lost upload replies replay that same durable receipt. A renewed direct client must be admitted against its current physical peer binding; certificate renewal does not rewrite startup-frozen TLS or transport policy. The separate opaque relay profile keeps its frozen key admission and refuses rotated routes; renewal for that profile still requires separate relay-owner integration.

For nonempty native fanout, retire_next_output_with_fanout borrows the existing recovered outbound runtime. Native PREPARED/PROJECTED, SOURCE-READY, producer PROJECTED and semantic/producer CONFIRMED retain their existing order. Signed native output retirement requires that same root's confirmed original horizon. publish_original_mailbox_retirement uploads the already stored signed control under the same native custody/publication fence and confirmed original horizon. A lost reply reuses that exact control; RetirementAccepted records only the correlated remote response. The client does not reclaim provider storage or claim model, effect or Process completion from a delivery receipt. Broader value schemas and effectful revisions remain refused by this finite Number, pure-model admission; extensions must use the existing compiled-model input/document writer, native producer, semantic escrow and effect owners. A mailbox callback never acquires execution authority.